Spaces:

capta1n
/

bas2

Running

App Files Files Community

capta1n commited on Apr 21, 2025

Commit

c6ddf8a

verified ·

1 Parent(s): f4d37ea

Add 3 files

Browse files

Files changed (3) hide show

README.md +7 -5
index.html +567 -19
prompts.txt +5 -0

README.md CHANGED Viewed

@@ -1,10 +1,12 @@
 ---
-title: Bas2
-emoji: 🚀
-colorFrom: indigo
-colorTo: green
 sdk: static
 pinned: false
 ---
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

 ---
+title: bas2
+emoji: 🐳
+colorFrom: pink
+colorTo: gray
 sdk: static
 pinned: false
+tags:
+  - deepsite
 ---
+Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

index.html CHANGED Viewed

@@ -1,19 +1,567 @@
-<!doctype html>
-<html>
-	<head>
-		<meta charset="utf-8" />
-		<meta name="viewport" content="width=device-width" />
-		<title>My static Space</title>
-		<link rel="stylesheet" href="style.css" />
-	</head>
-	<body>
-		<div class="card">
-			<h1>Welcome to your static Space!</h1>
-			<p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
-			<p>
-				Also don't forget to check the
-				<a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
-			</p>
-		</div>
-	</body>
-</html>

+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Phishing Attack Kill Chain Visualization</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <style>
+        .attack-node {
+            transition: all 0.3s ease;
+            cursor: pointer;
+            z-index: 2;
+            position: absolute;
+        }
+        .attack-node:hover {
+            transform: scale(1.05);
+            box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.2);
+        }
+        .critical {
+            border: 2px solid #ef4444;
+            animation: pulse 2s infinite;
+        }
+        @keyframes pulse {
+            0% { box-shadow: 0 0 0 0 rgba(239, 68, 68, 0.7); }
+            70% { box-shadow: 0 0 0 10px rgba(239, 68, 68, 0); }
+            100% { box-shadow: 0 0 0 0 rgba(239, 68, 68, 0); }
+        }
+        .data-flow {
+            stroke-dasharray: 5;
+            animation: dash 30s linear infinite;
+        }
+        @keyframes dash {
+            to {
+                stroke-dashoffset: -1000;
+            }
+        }
+        .sidebar {
+            transition: all 0.3s ease;
+            transform: translateX(100%);
+        }
+        .sidebar.open {
+            transform: translateX(0);
+        }
+        .zoom-container {
+            transition: transform 0.2s ease;
+        }
+        .attack-flow {
+            position: relative;
+            height: 600px;
+            width: 100%;
+            overflow: hidden;
+        }
+        .alert-item {
+            border-left: 3px solid;
+            transition: all 0.2s;
+        }
+        .alert-item:hover {
+            transform: translateX(3px);
+        }
+        .node-icon {
+            width: 30px;
+            height: 30px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            border-radius: 50%;
+            margin-bottom: 4px;
+        }
+        .sequence-number {
+            position: absolute;
+            top: -12px;
+            left: 50%;
+            transform: translateX(-50%);
+            background-color: #3b82f6;
+            color: white;
+            width: 24px;
+            height: 24px;
+            border-radius: 50%;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-size: 12px;
+            font-weight: bold;
+        }
+    </style>
+</head>
+<body class="bg-gray-100">
+    <div class="container mx-auto px-4 py-8">
+        <h1 class="text-3xl font-bold text-center text-gray-800 mb-2">Phishing Attack Kill Chain Visualization</h1>
+        <p class="text-center text-gray-600 mb-8">Sequential attack flow from initial compromise to data exfiltration</p>
+        <!-- Zoom Controls -->
+        <div class="flex justify-center mb-4 space-x-2">
+            <button id="zoom-in" class="px-3 py-1 bg-white rounded-md shadow hover:bg-gray-100">
+                <i class="fas fa-search-plus"></i> Zoom In
+            </button>
+            <button id="zoom-out" class="px-3 py-1 bg-white rounded-md shadow hover:bg-gray-100">
+                <i class="fas fa-search-minus"></i> Zoom Out
+            </button>
+            <button id="zoom-reset" class="px-3 py-1 bg-white rounded-md shadow hover:bg-gray-100">
+                <i class="fas fa-expand"></i> Reset
+            </button>
+        </div>
+        <!-- Main Visualization Container -->
+        <div class="relative bg-white rounded-xl shadow-lg p-6 overflow-hidden border border-gray-200">
+            <!-- Zoomable Container -->
+            <div id="zoom-container" class="zoom-container origin-center">
+                <!-- Background Grid -->
+                <div class="absolute inset-0 opacity-20">
+                    <svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg">
+                        <defs>
+                            <pattern id="grid" width="80" height="80" patternUnits="userSpaceOnUse">
+                                <path d="M 80 0 L 0 0 0 80" fill="none" stroke="gray" stroke-width="0.5"/>
+                            </pattern>
+                        </defs>
+                        <rect width="100%" height="100%" fill="url(#grid)" />
+                    </svg>
+                </div>
+                <!-- Attack Flow Container -->
+                <div class="attack-flow">
+                    <!-- Attack Flow SVG -->
+                    <svg class="absolute inset-0 w-full h-full" id="attack-flow"></svg>
+                    <!-- Attack Nodes - Sequential Layout -->
+                    <div id="attacker" class="attack-node bg-red-50 p-3 rounded-lg shadow-sm border-2 border-red-300 w-[140px] text-center" style="left: 5%; top: 50%;">
+                        <div class="node-icon bg-red-100">
+                            <i class="fas fa-user-secret text-red-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-red-800 text-sm">Attacker</h3>
+                        <p class="text-xs text-red-600 mt-1">C2: 185.143.223.47</p>
+                    </div>
+                    <!-- Step 1: Phishing Email -->
+                    <div id="step1" class="attack-node bg-blue-50 p-3 rounded-lg shadow-sm border-2 border-blue-300 w-[140px] text-center" style="left: 20%; top: 20%;">
+                        <div class="sequence-number">1</div>
+                        <div class="node-icon bg-blue-100">
+                            <i class="fas fa-envelope text-blue-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-blue-800 text-sm">Phishing Email</h3>
+                        <p class="text-xs text-blue-600 mt-1">"拥抱AI变革"通知</p>
+                    </div>
+                    <!-- Step 2: Malware Execution -->
+                    <div id="step2" class="attack-node bg-red-50 p-3 rounded-lg shadow-sm border-2 border-red-300 w-[140px] text-center" style="left: 35%; top: 35%;">
+                        <div class="sequence-number">2</div>
+                        <div class="node-icon bg-red-100">
+                            <i class="fas fa-bug text-red-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-red-800 text-sm">Malware Execution</h3>
+                        <p class="text-xs text-red-600 mt-1">Cobalt Strike DLL</p>
+                    </div>
+                    <!-- Step 3: C2 Communication -->
+                    <div id="step3" class="attack-node bg-purple-50 p-3 rounded-lg shadow-sm border-2 border-purple-300 w-[140px] text-center" style="left: 50%; top: 20%;">
+                        <div class="sequence-number">3</div>
+                        <div class="node-icon bg-purple-100">
+                            <i class="fas fa-network-wired text-purple-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-purple-800 text-sm">C2 Channel</h3>
+                        <p class="text-xs text-purple-600 mt-1">api.cloudfront[.]com</p>
+                    </div>
+                    <!-- Step 4: Credential Theft -->
+                    <div id="step4" class="attack-node bg-yellow-50 p-3 rounded-lg shadow-sm border-2 border-yellow-300 w-[140px] text-center" style="left: 65%; top: 35%;">
+                        <div class="sequence-number">4</div>
+                        <div class="node-icon bg-yellow-100">
+                            <i class="fas fa-key text-yellow-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-yellow-800 text-sm">Credential Theft</h3>
+                        <p class="text-xs text-yellow-600 mt-1">Mimikatz + Chrome</p>
+                    </div>
+                    <!-- Step 5: Cloud Docs Penetration -->
+                    <div id="step5" class="attack-node bg-green-50 p-3 rounded-lg shadow-sm border-2 border-green-300 w-[140px] text-center" style="left: 80%; top: 20%;">
+                        <div class="sequence-number">5</div>
+                        <div class="node-icon bg-green-100">
+                            <i class="fas fa-cloud text-green-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-green-800 text-sm">Cloud Docs Access</h3>
+                        <p class="text-xs text-green-600 mt-1">语雀API Token</p>
+                    </div>
+                    <!-- Step 6: Production Intrusion -->
+                    <div id="step6" class="attack-node bg-indigo-50 p-3 rounded-lg shadow-sm border-2 border-indigo-300 w-[140px] text-center" style="left: 35%; top: 65%;">
+                        <div class="sequence-number">6</div>
+                        <div class="node-icon bg-indigo-100">
+                            <i class="fas fa-server text-indigo-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-indigo-800 text-sm">DB Server Access</h3>
+                        <p class="text-xs text-indigo-600 mt-1">10.8.8.88</p>
+                    </div>
+                    <!-- Step 7: Data Exfiltration -->
+                    <div id="step7" class="attack-node bg-pink-50 p-3 rounded-lg shadow-sm border-2 border-pink-300 w-[140px] text-center" style="left: 50%; top: 80%;">
+                        <div class="sequence-number">7</div>
+                        <div class="node-icon bg-pink-100">
+                            <i class="fas fa-file-export text-pink-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-pink-800 text-sm">Data Exfiltration</h3>
+                        <p class="text-xs text-pink-600 mt-1">DNS隧道传输</p>
+                    </div>
+                    <!-- Final C2 Connection -->
+                    <div id="final-c2" class="attack-node bg-red-50 p-3 rounded-lg shadow-sm border-2 border-red-300 w-[140px] text-center" style="left: 80%; top: 65%;">
+                        <div class="node-icon bg-red-100">
+                            <i class="fas fa-exchange-alt text-red-600 text-lg"></i>
+                        </div>
+                        <h3 class="font-bold text-red-800 text-sm">C2 Connection</h3>
+                        <p class="text-xs text-red-600 mt-1">Data Exfil Complete</p>
+                    </div>
+                </div>
+            </div>
+            <!-- Sidebar for Attack Details -->
+            <div id="attack-sidebar" class="sidebar absolute top-0 right-0 w-96 h-full bg-white shadow-lg p-6 overflow-y-auto">
+                <button id="close-sidebar" class="absolute top-4 left-4 text-gray-500 hover:text-gray-700">
+                    <i class="fas fa-times"></i>
+                </button>
+                <div id="attack-details">
+                    <h2 class="text-xl font-bold text-gray-800 mb-4" id="step-title">Attack Step Details</h2>
+                    <div class="mb-6">
+                        <h3 class="font-medium text-gray-700 mb-2">Attack Behavior</h3>
+                        <div class="bg-gray-50 p-4 rounded-md" id="step-behavior">
+                            <p class="text-sm text-gray-600">Select an attack node to view details</p>
+                        </div>
+                    </div>
+                    <div class="mb-6">
+                        <h3 class="font-medium text-gray-700 mb-2">Triggered Security Products</h3>
+                        <div class="bg-gray-50 p-4 rounded-md" id="step-products">
+                            <p class="text-sm text-gray-600">No product selected</p>
+                        </div>
+                    </div>
+                    <div>
+                        <h3 class="font-medium text-gray-700 mb-2">Alert Information</h3>
+                        <div class="bg-gray-50 p-4 rounded-md" id="step-alerts">
+                            <p class="text-sm text-gray-600">No alerts to display</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+        <!-- Attack Timeline with Alerts -->
+        <div class="mt-8 bg-white rounded-lg shadow-md p-6">
+            <h2 class="text-xl font-bold text-gray-800 mb-4">Attack Timeline & Security Alerts</h2>
+            <div class="space-y-4">
+                <!-- Step 1 Alert -->
+                <div class="alert-item bg-blue-50 border-blue-500 p-4 rounded cursor-pointer" data-step="1">
+                    <div class="flex items-start">
+                        <div class="bg-blue-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-envelope text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-blue-800">Phishing Email Detected</h3>
+                                <span class="bg-blue-100 text-blue-800 text-xs px-2 py-1 rounded">邮件安全网关</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[严重] 检测到仿冒发件人邮件 | 发件人: itsupport@fakecompany[.]com → 目标: victim@corp.com</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 2 Alert -->
+                <div class="alert-item bg-red-50 border-red-500 p-4 rounded cursor-pointer" data-step="2">
+                    <div class="flex items-start">
+                        <div class="bg-red-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-bug text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-red-800">Malicious Process Injection</h3>
+                                <span class="bg-red-100 text-red-800 text-xs px-2 py-1 rounded">终端检测与响应 (EDR)</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[高危] 可疑进程注入行��� | 进程: C:\Windows\System32\explorer.exe → 加载内存模块: a09xdf.dll</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 3 Alert -->
+                <div class="alert-item bg-purple-50 border-purple-500 p-4 rounded cursor-pointer" data-step="3">
+                    <div class="flex items-start">
+                        <div class="bg-purple-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-network-wired text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-purple-800">Suspicious C2 Communication</h3>
+                                <span class="bg-purple-100 text-purple-800 text-xs px-2 py-1 rounded">网络流量分析 (NTA)</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[紧急] 异常外联行为 | 目标IP: 54.231.1.1（归属AWS新加坡） | 协议: HTTPS</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 4 Alert -->
+                <div class="alert-item bg-yellow-50 border-yellow-500 p-4 rounded cursor-pointer" data-step="4">
+                    <div class="flex items-start">
+                        <div class="bg-yellow-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-key text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-yellow-800">Credential Theft Detected</h3>
+                                <span class="bg-yellow-100 text-yellow-800 text-xs px-2 py-1 rounded">身份认证异常检测 (UEBA)</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[高危] 异常浏览器会话 | 用户: Victim_Account | IP来源: 172.16.1.23 → 登录设备指纹突变</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 5 Alert -->
+                <div class="alert-item bg-green-50 border-green-500 p-4 rounded cursor-pointer" data-step="5">
+                    <div class="flex items-start">
+                        <div class="bg-green-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-cloud text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-green-800">Sensitive Data Access</h3>
+                                <span class="bg-green-100 text-green-800 text-xs px-2 py-1 rounded">DLP (数据防泄漏)</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[严重] 敏感数据访问行为 | 用户: Victim_Account | 操作: 下载文档ID: YUQUE-1234</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 6 Alert -->
+                <div class="alert-item bg-indigo-50 border-indigo-500 p-4 rounded cursor-pointer" data-step="6">
+                    <div class="flex items-start">
+                        <div class="bg-indigo-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-server text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-indigo-800">Database Server Intrusion</h3>
+                <span class="bg-indigo-100 text-indigo-800 text-xs px-2 py-1 rounded">HIDS (主机入侵检测)</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[紧急] 非常规时间SSH登录 | 账号: dba_admin | 来源IP: 10.8.8.12 | 操作: 执行SHOW DATABASES</p>
+                        </div>
+                    </div>
+                </div>
+                <!-- Step 7 Alert -->
+                <div class="alert-item bg-pink-50 border-pink-500 p-4 rounded cursor-pointer" data-step="7">
+                    <div class="flex items-start">
+                        <div class="bg-pink-500 text-white p-2 rounded-full mr-3">
+                            <i class="fas fa-file-export text-sm"></i>
+                        </div>
+                        <div class="flex-1">
+                            <div class="flex justify-between items-start">
+                                <h3 class="font-medium text-pink-800">Data Exfiltration Detected</h3>
+                                <span class="bg-pink-100 text-pink-800 text-xs px-2 py-1 rounded">全流量威胁回溯</span>
+                            </div>
+                            <p class="text-sm text-gray-600 mt-1">[严重] 异常数据传输 | 协议: DNS TXT记录 | 目标域: xyz.attacker[.]com | 数据量: 142MB</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+    <script>
+        // Attack steps data
+        const attackSteps = {
+            1: {
+                title: "钓鱼邮件投递",
+                behavior: "伪造'拥抱AI变革'通知邮件，内含带恶意木马的文件（伪造成files.zip文件）",
+                products: "邮件安全网关",
+                alerts: "[严重] 检测到仿冒发件人邮件 | 发件人: itsupport@fakecompany[.]com → 目标: victim@corp.com | 包含恶意附件哈希(SHA256: a1b2c3...) | 判定为Emotet钓鱼模板"
+            },
+            2: {
+                title: "木马执行",
+                behavior: "受害者下载木马文件后触发PowerShell脚本，下载Cobalt Strike DLL并注入到合法进程",
+                products: "终端检测与响应（EDR）",
+                alerts: "[高危] 可疑进程注入行为 | 进程: C:\\Windows\\System32\\explorer.exe → 加载内存模块: a09xdf.dll | DLL签名无效且匹配已知Cobalt Strike特征码"
+            },
+            3: {
+                title: "C2通道建立与横向移动",
+                behavior: "通过CDN域名的HTTPS心跳通信（如api.cloudfront[.]com），部署反向SSH隧道至内网跳板机",
+                products: "网络流量分析（NTA）",
+                alerts: "[紧急] 异常外联行为 | 目标IP: 54.231.1.1（归属AWS新加坡） | 协议: HTTPS | 证书指纹异常（CN=*.cloudfront[.]com但签发者匹配Let's Encrypt野生证书）"
+            },
+            4: {
+                title: "凭据窃取与浏览器模拟",
+                behavior: "利用Mimikatz提取Chrome浏览器Cookie并伪造User-Agent（同步受害者浏览器指纹）",
+                products: "身份认证异常检测（UEBA）",
+                alerts: "[高危] 异常浏览器会话 | 用户: Victim_Account | IP来源: 172.16.1.23 → 登录设备指纹突变（新增虚拟机特征/QEMU虚拟显卡）"
+            },
+            5: {
+                title: "云文档渗透",
+                behavior: "通过劫持的语雀API Token访问《生产环境运维手册》，提取内嵌的SSH私钥（Base64编码）",
+                products: "DLP（数据防泄漏）",
+                alerts: "[严重] 敏感数据访问行为 | 用户: Victim_Account | 操作: 下载文档ID: YUQUE-1234 | 内容匹配关键字: 'prod_ssh_private_key'"
+            },
+            6: {
+                title: "生产网络入侵",
+                behavior: "通过跳板机使用SSH证书登陆MySQL数据库服务器（IP: 10.8.8.88，账号: dba_admin）",
+                products: "HIDS（主机入侵检测）",
+                alerts: "[紧急] 非常规时间SSH登录 | 账号: dba_admin | 来源IP: 10.8.8.12（测试环境跳板机） | 操作: 执行SHOW DATABASES"
+            },
+            7: {
+                title: "数据外泄",
+                behavior: "将压缩加密后的客户数据（文件名: taobaodata.tar.gz.enc）通过DNS隧道传输到alibaba-bas.com",
+                products: "全流量威胁回溯",
+                alerts: "[严重] 异常数据传输 | 协议: DNS TXT记录 | 目标域: xyz.attacker[.]com | 数据量: 142MB（超阈值500%）"
+            }
+        };
+        // Draw curved lines between nodes with arrows
+        function drawCurvedLine(svg, fromSelector, toSelector, color = "red", width = 2, animate = false) {
+            const fromEl = document.querySelector(fromSelector);
+            const toEl = document.querySelector(toSelector);
+            if (!fromEl || !toEl) return;
+            const fromRect = fromEl.getBoundingClientRect();
+            const toRect = toEl.getBoundingClientRect();
+            const svgRect = svg.getBoundingClientRect();
+            const x1 = fromRect.left + fromRect.width/2 - svgRect.left;
+            const y1 = fromRect.top + fromRect.height/2 - svgRect.top;
+            const x2 = toRect.left + toRect.width/2 - svgRect.left;
+            const y2 = toRect.top + toRect.height/2 - svgRect.top;
+            // Calculate control points for a smooth curve
+            const dx = x2 - x1;
+            const dy = y2 - y1;
+            const controlX1 = x1 + dx * 0.5;
+            const controlY1 = y1;
+            const controlX2 = x1 + dx * 0.5;
+            const controlY2 = y2;
+            // Create path for the line
+            const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+            path.setAttribute("d", `M${x1},${y1} C${controlX1},${controlY1} ${controlX2},${controlY2} ${x2},${y2}`);
+            path.setAttribute("stroke", color);
+            path.setAttribute("stroke-width", width);
+            path.setAttribute("fill", "none");
+            path.setAttribute("stroke-linecap", "round");
+            if (animate) {
+                path.classList.add("data-flow");
+            }
+            svg.appendChild(path);
+            // Add arrow marker at the end
+            const marker = document.createElementNS("http://www.w3.org/2000/svg", "marker");
+            marker.setAttribute("id", `arrow-${color.replace('#', '')}`);
+            marker.setAttribute("viewBox", "0 0 10 10");
+            marker.setAttribute("refX", "5");
+            marker.setAttribute("refY", "5");
+            marker.setAttribute("markerWidth", "6");
+            marker.setAttribute("markerHeight", "6");
+            marker.setAttribute("orient", "auto-start-reverse");
+            const arrowPath = document.createElementNS("http://www.w3.org/2000/svg", "path");
+            arrowPath.setAttribute("d", "M 0 0 L 10 5 L 0 10 z");
+            arrowPath.setAttribute("fill", color);
+            marker.appendChild(arrowPath);
+            svg.appendChild(marker);
+            path.setAttribute("marker-end", `url(#arrow-${color.replace('#', '')})`);
+        }
+        // Show attack details in sidebar
+        function showAttackDetails(stepId) {
+            const step = attackSteps[stepId];
+            if (!step) return;
+            document.getElementById("step-title").textContent = step.title;
+            document.getElementById("step-behavior").innerHTML = `<p class="text-sm text-gray-600">${step.behavior}</p>`;
+            document.getElementById("step-products").innerHTML = `<p class="text-sm text-gray-600">${step.products}</p>`;
+            document.getElementById("step-alerts").innerHTML = `<p class="text-sm text-gray-600">${step.alerts}</p>`;
+            // Highlight the selected node
+            document.querySelectorAll('.attack-node').forEach(node => {
+                node.classList.remove('critical');
+            });
+            document.getElementById(`step${stepId}`).classList.add('critical');
+            // Open sidebar
+            document.getElementById("attack-sidebar").classList.add("open");
+        }
+        // Initialize visualization
+        function initVisualization() {
+            const svg = document.getElementById("attack-flow");
+            svg.innerHTML = "";
+            // Draw all attack paths in sequence with different colors
+            drawCurvedLine(svg, "#attacker", "#step1", "#3b82f6", 2); // Blue
+            drawCurvedLine(svg, "#step1", "#step2", "#ef4444", 2); // Red
+            drawCurvedLine(svg, "#step2", "#step3", "#8b5cf6", 2); // Purple
+            drawCurvedLine(svg, "#step3", "#step4", "#f59e0b", 2); // Yellow
+            drawCurvedLine(svg, "#step4", "#step5", "#10b981", 2); // Green
+            drawCurvedLine(svg, "#step5", "#step6", "#6366f1", 2); // Indigo
+            drawCurvedLine(svg, "#step6", "#step7", "#ec4899", 2); // Pink
+            drawCurvedLine(svg, "#step7", "#final-c2", "#ef4444", 2); // Red
+            drawCurvedLine(svg, "#final-c2", "#attacker", "#ef4444", 2, true); // Animated red
+        }
+        // Zoom functionality
+        let scale = 1;
+        const zoomContainer = document.getElementById("zoom-container");
+        document.getElementById("zoom-in").addEventListener("click", () => {
+            scale += 0.1;
+            zoomContainer.style.transform = `scale(${scale})`;
+        });
+        document.getElementById("zoom-out").addEventListener("click", () => {
+            if (scale > 0.5) {
+                scale -= 0.1;
+                zoomContainer.style.transform = `scale(${scale})`;
+            }
+        });
+        document.getElementById("zoom-reset").addEventListener("click", () => {
+            scale = 1;
+            zoomContainer.style.transform = `scale(${scale})`;
+        });
+        // Initialize
+        document.addEventListener("DOMContentLoaded", () => {
+            initVisualization();
+            // Add click handlers to attack nodes
+            for (let i = 1; i <= 7; i++) {
+                document.getElementById(`step${i}`).addEventListener("click", () => {
+                    showAttackDetails(i);
+                });
+            }
+            // Add click handlers to timeline alerts
+            document.querySelectorAll('.alert-item').forEach(alert => {
+                alert.addEventListener('click', () => {
+                    const stepId = alert.getAttribute('data-step');
+                    showAttackDetails(stepId);
+                });
+            });
+            // Close sidebar
+            document.getElementById("close-sidebar").addEventListener("click", () => {
+                document.getElementById("attack-sidebar").classList.remove("open");
+                document.querySelectorAll('.attack-node').forEach(node => {
+                    node.classList.remove('critical');
+                });
+            });
+            // Add hover effects to nodes
+            document.querySelectorAll('.attack-node').forEach(node => {
+                node.addEventListener('mouseenter', () => {
+                    node.classList.add('shadow-md');
+                });
+                node.addEventListener('mouseleave', () => {
+                    node.classList.remove('shadow-md');
+                });
+            });
+        });
+    </script>
+<p style="border-radius: 8px; text-align: center; font-size: 12px; color: #fff; margin-top: 16px;position: fixed; left: 8px; bottom: 8px; z-index: 10; background: rgba(0, 0, 0, 0.8); padding: 4px 8px;">Made with <img src="https://enzostvs-deepsite.hf.space/logo.svg" alt="DeepSite Logo" style="width: 16px; height: 16px; vertical-align: middle;display:inline-block;margin-right:3px;filter:brightness(0) invert(1);"><a href="https://enzostvs-deepsite.hf.space" style="color: #fff;text-decoration: underline;" target="_blank" >DeepSite</a> - 🧬 <a href="https://enzostvs-deepsite.hf.space?remix=capta1n/bas2" style="color: #fff;text-decoration: underline;" target="_blank" >Remix</a></p></body>
+</html>

prompts.txt ADDED Viewed

	@@ -0,0 +1,5 @@

+将图表中的攻击步骤内容换成以下攻击步骤内容，不要采用分布的形式展示攻击步骤，在一个图表中完整展示攻击步骤，图表支持放大缩小，图表中的连线采用曲线连线，不要和节点有冲突。以攻击者为起点，每个节点为一个攻击行为，每个攻击节点点开后侧边弹窗展示具体的攻击行为内容，下方展示每个步骤触发的防护产品名称和告警信息内容。 步骤1：钓鱼邮件投递 ● 攻击行为：伪造"拥抱AI变革"通知邮件，内含带恶意木马的文件（伪造成files.zip文件） ● 触发防护：邮件安全网关 ● 告警信息：[严重] 检测到仿冒发件人邮件 | 发件人: itsupport@fakecompany[.]com → 目标: victim@corp.com | 包含恶意附件哈希(SHA256: a1b2c3...) | 判定为Emotet钓鱼模板 步骤2：木马执行 ● 攻击行为：受害者下载木马文件后触发PowerShell脚本，下载Cobalt Strike DLL并注入到合法进程 ● 触发防护：终端检测与响应（EDR） ● 告警信息：[高危] 可疑进程注入行为 | 进程: C:\Windows\System32\explorer.exe → 加载内存模块: a09xdf.dll | DLL签名无效且匹配已知Cobalt Strike特征码 步骤3：C2通道建立与横向移动 ● 攻击行为：通过CDN域名的HTTPS心跳通信（如api.cloudfront[.]com），部署反向SSH隧道至内网跳板机 ● 触发防护：网络流量分析（NTA） ● 告警信息：[紧急] 异常外联行为 | 目标IP: 54.231.1.1（归属AWS新加坡） | 协议: HTTPS | 证书指纹异常（CN=*.cloudfront[.]com但签发者匹配Let's Encrypt野生证书） 步骤4：凭据窃取与浏览器模拟 ● 攻击行为：利用Mimikatz提取Chrome浏览器Cookie并伪造User-Agent（同步受害者浏览器指纹） ● 触发防护：身份认证异常检测（UEBA） ● 告警信息:[高危] 异常浏览器会话 | 用户: Victim_Account | IP来源: 172.16.1.23 → 登录设备指纹突变（新增虚拟机特征/QEMU虚拟显卡） 步骤5：云文档渗透 ● 攻击行为：通过劫持的语雀API Token访问《生产环境运维手册》，提取内嵌的SSH私钥（Base64编码） ● 触发防护：DLP（数据防泄漏） ● 告警信息：[严重] 敏感数据访问行为 | 用户: Victim_Account | 操作: 下载文档ID: YUQUE-1234 | 内容匹配关键字: "prod_ssh_private_key" 步骤6：生产网络入侵 ● 攻击行为：通过跳板机使用SSH证书登陆MySQL数据库服务器（IP: 10.8.8.88，账号: dba_admin） ● 触发防护：HIDS（主机入侵检测） ● 告警信息：[紧急] 非常规时间SSH登录 | 账号: dba_admin | 来源IP: 10.8.8.12（测试环境跳板机） | 操作: 执行SHOW DATABASES  步骤7：数据外泄 ● 攻击行为：将压缩加密后的客户数据（文件名: taobaodata.tar.gz.enc）通过DNS隧道传输到alibaba-bas.com ● 触发防护：全流量威胁回溯 ● 告警信息：[严重] 异常数据传输 | 协议: DNS TXT记录 | 目标域: xyz.attacker[.]com | 数据量: 142MB（超阈值500%）
+按顺序展示攻击步骤优化图表中的布局，不要都集中在一起
+将以下攻击步骤转化为图表的形式进行展示，在一个图表中完整按顺序展示攻击步骤，图表支持放大缩小，图表中的连线和连线不要重叠。以攻击者为起点，每个节点为一个攻击行为，每个攻击节点之间按顺序用剪头进行连接，每个攻击节点点开后侧边弹窗展示具体的攻击行为内容，图表下方展示每个步骤触发的防护产品名称和告警信息内容。步骤1：钓鱼邮件投递 ● 攻击行为：伪造"拥抱AI变革"通知邮件，内含带恶意木马的文件（伪造成files.zip文件） ● 触发防护：邮件安全网关 ● 告警信息：[严重] 检测到仿冒发件人邮件 | 发件人: itsupport@fakecompany[.]com → 目标: victim@corp.com | 包含恶意附件哈希(SHA256: a1b2c3...) | 判定为Emotet钓鱼模板 步骤2：木马执行 ● 攻击行为：受害者下载木马文件后触发PowerShell脚本，下载Cobalt Strike DLL并注入到合法进程 ● 触发防护：终端检测与响应（EDR） ● 告警信息：[高危] 可疑进程注入行为 | 进程: C:\Windows\System32\explorer.exe → 加载内存模块: a09xdf.dll | DLL签名无效且匹配已知Cobalt Strike特征码 步骤3：C2通道建立与横向移动 ● 攻击行为：通过CDN域名的HTTPS心跳通信（如api.cloudfront[.]com），部署反向SSH隧道至内网跳板机 ● 触发防护：网络流量分析（NTA） ● 告警信息：[紧急] 异常外联行为 | 目标IP: 54.231.1.1（归属AWS新加坡） | 协议: HTTPS | 证书指纹异常（CN=*.cloudfront[.]com但签发者匹配Let's Encrypt野生证书） 步骤4：凭据窃取与浏览器模拟 ● 攻击行为：利用Mimikatz提取Chrome浏览器Cookie并伪造User-Agent（同步受害者浏览器指纹） ● 触发防护：身份认证异常检测（UEBA） ● 告警信息:[高危] 异常浏览器会话 | 用户: Victim_Account | IP来源: 172.16.1.23 → 登录设备指纹突变（新增虚拟机特征/QEMU虚拟显卡） 步骤5：云文档渗透 ● 攻击行为：通过劫持的语雀API Token访问《生产环境运维手册》，提取内嵌的SSH私钥（Base64编码） ● 触发防护：DLP（数据防泄漏） ● 告警信息：[严重] 敏感数据访问行为 | 用户: Victim_Account | 操作: 下载文档ID: YUQUE-1234 | 内容匹配关键字: "prod_ssh_private_key" 步骤6：生产网络入侵 ● 攻击行为：通过跳板机使用SSH证书登陆MySQL数据库服务器（IP: 10.8.8.88，账号: dba_admin） ● 触发防护：HIDS（主机入侵检测） ● 告警信息：[紧急] 非常规时间SSH登录 | 账号: dba_admin | 来源IP: 10.8.8.12（测试环境跳板机） | 操作: 执行SHOW DATABASES  步骤7：数据外泄 ● 攻击行为：将压缩加密后的客户数据（文件名: taobaodata.tar.gz.enc）通过DNS隧道传输到alibaba-bas.com ● 触发防护：全流量威胁回溯 ● 告警信息：[严重] 异常数据传输 | 协议: DNS TXT记录 | 目标域: xyz.attacker[.]com | 数据量: 142MB（超阈值500%）
+1、调整图表中的节点大小，确保图表可以完整展示全部的攻击节点 2、每个攻击节点之间按顺序用剪头进行连接
+1. 缩小每个节点的大小确保图表可以完整清晰的展示全部攻击节点和节点之间的执行顺序